diff options
author | Norbert Preining <preining@logic.at> | 2016-04-12 06:10:02 +0000 |
---|---|---|
committer | Norbert Preining <preining@logic.at> | 2016-04-12 06:10:02 +0000 |
commit | 891bd590ba9068adae1e8070e07abf95a3f3d413 (patch) | |
tree | 1cb63fcaaaffcdcf4e88ed229b2d75f7696c601f /Master/tlpkg | |
parent | 61d9ec43616124e96862cca64c4b5a81479944d4 (diff) |
unify the verify_* functions, simplify code, verify checksum file
git-svn-id: svn://tug.org/texlive/trunk@40444 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Master/tlpkg')
-rw-r--r-- | Master/tlpkg/TeXLive/TLUtils.pm | 165 |
1 files changed, 78 insertions, 87 deletions
diff --git a/Master/tlpkg/TeXLive/TLUtils.pm b/Master/tlpkg/TeXLive/TLUtils.pm index 4300bb486ea..23abd1f9f3d 100644 --- a/Master/tlpkg/TeXLive/TLUtils.pm +++ b/Master/tlpkg/TeXLive/TLUtils.pm @@ -100,7 +100,6 @@ C<TeXLive::TLUtils> -- utilities used in TeX Live infrastructure TeXLive::TLUtils::give_ctan_mirror_base(); TeXLive::TLUtils::tlmd5($path); TeXLive::TLUtils::tlchecksum($path); - TeXLive::TLUtils::verify_checksum($file, $checksum); TeXLive::TLUtils::setup_gpg(); TeXLive::TLUtils::verify_download($file, $url); TeXLive::TLUtils::compare_tlpobjs($tlpA, $tlpB); @@ -178,7 +177,6 @@ BEGIN { &extract_mirror_entry &tlmd5 &tlchecksum - &verify_checksum &setup_gpg &verify_download &wsystem @@ -3622,57 +3620,6 @@ sub tlchecksum_data { =pod -=item C<< verify_checksum ($file, $checksum) >> - -Verifies the checksum of the (already downloaded) file against -C<$checksum> (which can be a remote URL). - -Returns 1 on success, and a pair of 0 and a warning otherwise. - -=cut - -sub verify_checksum { - my ($file_data, $checksum) = @_; - ddebug("verify_checksum: remote path of digest = $checksum\n"); - my $local_digest; - my $remote_digest; - my ($cs_fh, $cs_file); - my $ret = 1; - if ($checksum =~ m,^(http|ftp)://,) { - ($cs_fh, $cs_file) = File::Temp::tempfile(); - # now $cs_fh filehandle is open, the file created - # TLUtils::download_file will just overwrite what is there - # on windows that doesn't work, so we close the fh immediately - # this creates a short loophole, but much better than before anyway - close($cs_fh); - $ret = download_file($checksum, $cs_file); - } else { - $cs_file = $checksum; - } - if ($ret && (-r "$cs_file")) { - open $cs_fh, "<$cs_file" or return(0, "file not found"); - if (read ($cs_fh, $remote_digest, $ChecksumLength) != $ChecksumLength) { - return(0, "read error"); - } else { - close($cs_fh); - ddebug("found remote digest: $remote_digest\n"); - } - } else { - return(0, "digest not found"); - } - $local_digest = tlchecksum_data($file_data); - ddebug("local_digest = $local_digest\n"); - if ($local_digest eq $remote_digest) { - debug("checksum of local copy identical with remote hash\n"); - return(1); - } else { - return(0, "checksum error"); - } - return(0, "not reachable"); -} - -=pod - =item C<< setup_gpg() >> Tries to set up gpg command line C<$::gpg> used for @@ -3706,12 +3653,9 @@ sub setup_gpg { =pod -=item C<< verify_download($file, $url) >> - -Verifies a download of C<$url> into C<$file> by checking C<$url.checksum> -and if gpg is available, verifying that with C<$url.checksum.gpg>. +=item C<< slurp_file($file) >> -Returns 1 on success, and a pair of 0 and a warning otherwise. +Reads the whole file and returns the content in a scalar. =cut @@ -3725,39 +3669,64 @@ sub slurp_file { return($file_data); } + +=pod + +=item C<< verify_download($file, $url) >> + +Verifies a download of C<$url> into C<$file> by checking C<$url.checksum> +and if gpg is available, verifying that with C<$url.checksum.asc>. + +Returns 1 on success, and a pair of 0 and a warning otherwise. + +=cut + +sub download_to_temp_or_file { + my $url = shift; + my ($url_fh, $url_file); + if ($url =~ m,^(http|ftp|file)://,) { + ($url_fh, $url_file) = File::Temp::tempfile(UNLINK => 1); + # now $url_fh filehandle is open, the file created + # TLUtils::download_file will just overwrite what is there + # on windows that doesn't work, so we close the fh immediately + # this creates a short loophole, but much better than before anyway + close($url_fh); + $ret = download_file($url, $url_file); + } else { + $url_file = $url; + $ret = 1; + } + if ($ret && (-r "$url_file")) { + return $url_file; + } + return; +} + sub verify_download { my ($file, $url) = @_; - # we need the tlpdb data read in - my $file_data = slurp_file($file); - # first verify digest - my ($ret, $msg) = verify_checksum($file_data, "$url.checksum"); - return($ret,$msg) if (!$ret); - # next try to verify gpg - $ret = 1; # default for gpg download + # download checksum file + my $checksum_url = "$url.checksum"; + my $signature_url = "$checksum_url.asc"; + + my $checksum_file = download_to_temp_or_file($checksum_url); + if (!$checksum_file) { + # we do not accept if not even a checksum file is present, error out + return(0, "checksum file not found"); + } + + # if we have $::gpg set, we try to verify cryptographic signatures if ($::gpg) { - my $urlgpg = "$url.asc"; - my ($signature_fh, $signature_file); - if ($urlgpg =~ m,^(http|ftp|file)://,) { - ($signature_fh, $signature_file) = File::Temp::tempfile(UNLINK => 1); - # now $gpg_fh filehandle is open, the file created - # TLUtils::download_file will just overwrite what is there - # on windows that doesn't work, so we close the fh immediately - # this creates a short loophole, but much better than before anyway - close($signature_fh); - $ret = download_file($urlgpg, $signature_file); - } else { - $signature_file = $urlgpg; - } - if ($ret && (-r "$signature_file")) { - if (TeXLive::TLUtils::gpg_verify_signature($file, $signature_file)) { - info("cryptographic signature of $url verified\n"); + my $signature_file = download_to_temp_or_file($signature_url); + if ($signature_file) { + if (TeXLive::TLUtils::gpg_verify_signature($checksum_file, $signature_file)) { + info("cryptographic signature of $checksum_url verified\n"); } else { - tldie(<<GPGERROR); -Verification of downloaded file - $file + return(0, <<GPGERROR); +cryptograpic verification of + $checksum_url against - $urlgpg -did not succeed. Please report to texlive\@tug.org + $signature_url +failed. Please report to texlive\@tug.org GPGERROR } } else { @@ -3766,7 +3735,29 @@ GPGERROR } else { debug("gpg prog not defined, no checking of signatures\n"); } - # we tldie out above if verification failed, so be happy for now + + # if we are still here, then either verification was successful, + # or no gpg or signature found + + # next step is verification of tlpdb checksum with checksum file + # existenc of checksum_file was checked above + open $cs_fh, "<$checksum_file" or die("cannot read file: $!"); + if (read ($cs_fh, $remote_digest, $ChecksumLength) != $ChecksumLength) { + close($cs_fh); + return(0, "read error from $checksum_file"); + } else { + close($cs_fh); + ddebug("found remote digest: $remote_digest\n"); + } + $local_digest = tlchecksum($file); + ddebug("local_digest = $local_digest\n"); + if ($local_digest ne $remote_digest) { + return(0, "checksum error"); + } + + # we are still here, so checksum also succeeded + debug("checksum of local copy identical with remote hash\n"); + return(1); } |